April 2013 - Pki-devel - Dogtag PKI List Archives

[PATCH] 248 Restored /etc/pki/pki.conf.
by Endi Sukma Dewata 30 Apr '13

30 Apr '13

The /etc/pki/pki.conf has been restored. The upgrade tracker now will be appended to pki.conf on fresh installation. -- Endi S. Dewata

1 2

AVCs for Dogtag 10.0.2 RA and TPS . . .
by Matthew Harmsen 30 Apr '13

30 Apr '13

Ade, I successfully installed a CA, KRA, OCSP, and TKS using command-line pkispawn with a configuration file. Thus far, I have provided a Karma point for TPS and for RA; currently having trouble with pki-console (due to my X Display not working, not the package itself). Once you re-spin pki-core, I can perform a GUI install of these subsystems and provide a karma point for both pki-coreand dogtag-pki-theme (once I confirm that console is working). After this, in order to confirm that dogtag-pki is working, I will need to remove all of the packages from my system and configure it to point to the appropriate test repo to make certain that it will grab the correct versions of Dogtag. Per your request, here are the TPS and RA AVC's showing up in the audit.log (I installed the TPS prior to the RA without cleaning the audit log):* * *TPS:* *# getenforce* Permissive *# cat /var/log/audit/audit.log | audit2allow -R* require { type httpd_suexec_exec_t; type pki_tps_t; class file { read getattr execute }; } #============= pki_tps_t ============== allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_tps_t) files_manage_generic_tmp_files(pki_tps_t) *RA:* *# getenforce* Permissive *# cat /var/log/audit/audit.log | audit2allow -R* require { type pki_tps_t; type pki_ra_t; type httpd_suexec_exec_t; class file { getattr read execute }; } #============= pki_ra_t ============== allow pki_ra_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_ra_t) files_manage_generic_tmp_files(pki_ra_t) #============= pki_tps_t ============== allow pki_tps_t httpd_suexec_exec_t:file { read getattr execute }; files_manage_generic_tmp_dirs(pki_tps_t) files_manage_generic_tmp_files(pki_tps_t) -- Matt

1 0

[PATCH] 247 Fixed undefined PKIException.
by Endi Sukma Dewata 29 Apr '13

29 Apr '13

The pki.server module has been fixed to include the module name of the PKIException. -- Endi S. Dewata

1 1

[PATCH] 246 Fixed undefined BASE_DIR.
by Endi Sukma Dewata 29 Apr '13

29 Apr '13

The pki.server module has been fixed to include the module name of the BASE_DIR. -- Endi S. Dewata

1 1

[PATCH] 245 Added upgrade scriptlet to add JNI_JAR_DIR.
by Endi Sukma Dewata 29 Apr '13

29 Apr '13

A new upgrade scriptlet has been added to add JNI_JAR_DIR into pki.conf. The code to manipulate property files has been refactored from PKIUpgradeTracker into a separate PropertyFile class to allow reuse. The pki-base package has been modified to deliver a default pki.conf in /usr/share/pki/etc and copy it into /etc/pki if it doesn't exist. -- Endi S. Dewata

1 1

[PATCH] 244 Fixed server upgrade problem on new installation.
by Endi Sukma Dewata 29 Apr '13

29 Apr '13

The PKIServerUpgrader.get_current_version() incorrectly returns None if there is no instance on the system. It has been modified to return the target version so that no upgrade operation will occur. Bugzilla #957690 -- Endi S. Dewata

1 1

[PATCH] 243 Reverting to old CLI behavior on client database initialization.
by Endi Sukma Dewata 28 Apr '13

28 Apr '13

Recently the CLI was changed to initialize the default client database automatically which will create it if it did not exist before. This was causing a problem since the database was not created with a password. To create the database properly a separate command is needed. For now the CLI is reverted to the old behavior where it initializes the database only if it requires for SSL connection and/or client authentication. -- Endi S. Dewata

2 1

[PATCH] 242 Added separate CLI option for client database password.
by Endi Sukma Dewata 28 Apr '13

28 Apr '13

Previously the -w option is used to specify the password for either the username/password authentication or client database password to do client certificate authentication. Since the passwords now may be used at the same time, a new -c option has been added for the client database password. -- Endi S. Dewata

2 1

[PATCH] 241 Ignoring warnings/errors during installation.
by Endi Sukma Dewata 28 Apr '13

28 Apr '13

The code used by pkispawn and pkidestroy has been modified to ignore certificate validity warnings/errors that happens during installation. The instanceCreationMode is now redundant and has been removed from ClientConfig. -- Endi S. Dewata

2 1

[PATCH] 240 Replaced ~/.pki with ~/.dogtag.
by Endi Sukma Dewata 27 Apr '13

27 Apr '13

The default folder for to store user files in the home directory has been changed from .pki to .dogtag. -- Endi S. Dewata

1 1